361517 - Don't fill in passwords / usernames in readonly fields.

Status: RESOLVED FIXED

(Toolkit :: Password Manager, defect)

Description

[Michal Moscovic]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

If there is a input field like this:
<input type="password" name="password" value="password" readonly="readonly">
firefox still remembers the password here...
Next time the page is loaded (e. g. for other user) the password is replacen by the remembered password even if there is a readonly attribute!

passwords for readonly fields shouldn't be saved, because in that case user cannot retype them!

Reproducible: Always

Steps to Reproduce:
1. create a page with <input type="password" name="password" value="password" readonly="readonly">
2. submit pade and enable firefox to remember the password
3. change the page to 1. create a page with <input type="password" name="password" value="pass" readonly="readonly">


Actual Results:  
load the page... firefox will replace the password on load (the nuber of "stars" will change)
submit the page and check that it passes the remembered password


Expected Results:  
expected result will be, that the read only password wouldn't be offered to save...
or
after loading and submiting changed page the passed password would be the new one

Comment 1

[Jesse Ruderman]

*** Bug 331441 has been marked as a duplicate of this bug. ***

Comment 2

[Jesse Ruderman]

*** Bug 294458 has been marked as a duplicate of this bug. ***

Comment 3

[Jesse Ruderman]

*** Bug 312877 has been marked as a duplicate of this bug. ***

Comment 4

[Phil Ringnalda (:philor)]

Just to be sure I'm working on the right problem: is the form where you see the problem password-only, with no username? And is your saved password from a password-only form, or with a blank username, or a username-password pair?

(Yes, we could just bail out whenever we see anything readonly, but that would sometimes be wrong, e.g. with a readonly prefilled username we know, and an unfilled non-readonly password.)

Comment 5

[tech]

I don't really understand why the long time opened and confirmed bugs 331441 (Opened: 2006-03-23) 312877 (Opened: 2005-10-18), 294458 (Opened: 2005-05-17) 
were marked as duplicate of this one which is marked as UNCONFIRMED ?
you might have made a mistake

Comment 6

[Phil Ringnalda (:philor)]

They were all marked as duplicates of a bug which did fix their reported problem. They are marked as duplicates of a bug which (probably, though not certainly) will again fix their reported problem, in a different way. This is not an issue which is worth the death of several million electrons.

Comment 7

[Justin Dolske [:Dolske]]

I don't see why the password mananger shouldn't remember readonly fields. They are, after all, readable.

As for filling them in... I can see two sides to the issue. One is that we shouldn't modify a readonly field, because the user can't either. On the other hand, readonly fields are only a UI convention, and scripts have always been allowed to modify them.

Comment 8

[Ulrich Windl]

I have two problems with this issue:
1) What sense does a read-only password field make (i.e. what's a reasonable use case)? IMHO read-only fields are an _output_ aid, but with type "password" you won't actually see anything reasonable.
2) The password manager might _remember_ read-only fields, but it probably should not _fill in_ read-only fields. This is independent from the fact that a script might change them, because the "script" is expected to come from the same source as the rest of the HTTP application. The browser should not interfere with that in an unexpected way.

Comment 9

[Justin Dolske [:Dolske]]

Random note: Camino bug 384635 was for filling in disabled fields, another case similar to this bug.

Comment 10

[Justin Dolske [:Dolske]]

We just made a similar change to not fill in values that exceed an input's maxlength, which was beneficial for sites with mixed username/password + PIN logins. This change may have similar benefits.

Comment 11

[Justin Dolske [:Dolske]]

Attachment: Patch, work in progress v.1

Untested, but it's simple enough. However, I think I should first shuffle some code around so the same thing happens when you (1) initially fill the form on page load and (2) perform an autocomplete entry. I'll file a blocking bug.

Comment 12

[Justin Dolske [:Dolske]]

Attachment: Patch v.2

Simpler version of last patch.

Comment 13

[Justin Dolske [:Dolske]]

Pushed changeset 9c433cbaff34.

Comment 15

[neelbhandari]

duplicate bug